Applies to Windows Server 2008, Windows Vista, Windows Server 2008 R2, Windows 7

Best Practice for Configuring Certificate Template Cryptography

Starting with Windows Vista and Windows Server 2008, the option to utilize Key Storage Providers (KSPs) in addition to Cryptographic Service Providers (CSPs) was added. These options are available when you create a Certificate Template and configure the settings in the Cryptography tab. Depending on the template duplicated, you may see that the default option is Request can use any provider available on the subject’s computer. However, the best practice is to select Requests must use one of the following providers. Then, ensure you configure only the providers that you want to be used.



You should also be aware that:

1. The CSP or KSP list (depending on the template schema version) is only a suggestion for the client computers.
2. Client computers may ignore this list, as the certification authority cannot enforce the CSP or KSP list settings.
3. The client computers process the CSP or KSP list one entry at a time.
a. For each entry try to generate private/public key pairs using the CSP or KSP. The order of the CSP or KSP list is not configurable on certificate client computers running Windows 7, Windows Server 2008 R2 or earlier operating systems.
b. If key generation fails on a particular CSP or KSP, the next entry in the list will be attempted.

If you do not specify particular CSPs or KSPs in the template, you increase the potential for cryptographic incompatibilities. For example, assume a template is configured such that the Request Handling tab is configured to Allow private key to be exported.



Also, the Cryptography tab is set to Requests can use any provider available on the subject’s computer. The client computer could potentially select the Microsoft Smart Card Key Storage Provider. If this happens, then the client will fail to enroll for the certificate and the error message “A certificate could not be created. A private key could not be created” is displayed. To help to avoid this situation, follow the best practice of selecting the cryptographic keys that you want used on the Cryptography tab by selecting Requests must use one of the following providers.